Set/Delete Cookies on cross subdomain Server Side and JavaScript

1
votes

I have domain.com, sub1.domain.com and sub2.domain.com. From a site of sub1.domain.com i call a script to set cookie on domain.com like this

document.cookie = "KEY=Value; domain=.domain.com; path=/; expires=Thu, 01 Jan 2013 00:00:01 GMT";

I check browser an see that cookie. Look good. After that I go to sub2.domain.com to modify or delete the cookie I've created.

document.cookie = "KEY=Deleted; domain=.domain.com; path=/; expires=Thu, 01 Jan 1990 00:00:01 GMT";

But no luck, Cookies are still there, value remain. What should I do to remove root cookie from subdomain?

EDIT:

To make it clear: I use citrix single sign on to authenticate on both domain. we just have to login to .domain.com and citric will authenticate the rest. But the problem is it does not have sign out mechaniz so I have decide to clear cookies. It work when i clear it with browser plugins. But when it come to code (javascript) it won't work. Does anyone know this

1
javascriptasp.netsessioncookiescitrix
I foresee 2 possible problems. The 1-st is that you can't actually see this cookie available for domain.com, bacause it does not match domain pattern (.domain.com can match any *.domain.com, including www.domain.com, but not domain.com without subdomains). So it seems, that first time you checked cookie from either sub1 or sub2, and the second time you checked it from the main domain. The 2-nd possible problem is that you have different sheme (i.e. http and https) or port numbers (it's not clear from the question). - Stan
I check cookies with forefox and I see it... .domain.com is correct. I'm not sure http or https affect? - Trinh Hoang Nhu

1 Answers

0
votes

Ok I know the problem! Thoese cookie are httponly cookie, that mean we cannot access via javascript. I have to modified them on server side

HttpCookie expiredCookie = new HttpCookie("CookieName");
expiredCookie.Expires = DateTime.UtcNow.AddDays(-1);
expiredCookie.Path = "/";
expiredCookie.Domain = ".domain.com";
Response.Cookies.Add(expiredCookie);